Cookie Policy

1. What Cookies Are

Cookies are small text files or similar records stored on or accessed from a browser or device when a website is visited.

Cookies can enable a website to:

• recognise a browser or session;
• maintain secure sign-in;
• remember preferences;
• retain selected objects;
• understand technical performance;
• distinguish legitimate activity from abuse.

Some technologies perform functions similar to cookies, including local storage, pixels, tags and software-development-kit identifiers. References to “cookies” in this policy include comparable technologies where appropriate.

2. First-Party and Third-Party Cookies

First-party cookies are set or accessed by CastaliaLux or by services operating directly on behalf of the website.

Third-party cookies or technologies are set or accessed by an independent provider integrated into the website, such as an authentication, payment, analytics, media or security service.

Third-party providers may process information under their own privacy policies.

3. Session and Persistent Cookies

Session cookies ordinarily expire when the browser session ends.

Persistent cookies remain for a defined period or until deleted through browser or device settings.

The duration of a cookie depends on its function and the settings applied by the relevant provider.

4. Strictly Necessary Cookies

Strictly necessary cookies support functions required for the website to operate or for a service expressly requested by the user.

They may be used to:

• enable secure navigation;
• maintain authentication;
• protect accounts;
• operate the Acquisition bag;
• preserve checkout progress;
• remember privacy choices;
• prevent fraud;
• distribute technical traffic;
• maintain website security.

Because these technologies are necessary to provide core functions, they may not be subject to optional consent where applicable law permits this.

Disabling them through browser settings may prevent parts of the website from functioning correctly.

5. Preference and Functional Technologies

Preference technologies may remember choices such as:

• interface preferences;
• sound settings;
• selected objects;
• session continuity;
• certain display or navigation choices.

Some preferences may be stored in browser local storage rather than conventional cookies.

Where legally required, optional preference technologies should be activated only after the appropriate choice has been made.

6. Analytics and Performance Technologies

When analytics are active, we use Google Analytics 4 (“GA4”) to understand visits to the public website. Page views are recorded by Google’s standard automatic tracking: one when a page first loads and, as the website’s address changes while you browse — including navigation within the website and movements Back and Forward — further page views containing the page address (including any search, filter or sorting choices shown in the address), page title and time of the view. Changing filters or sorting can therefore be recorded as an additional page view. Visitors who are signed in, including administrators, are measured in the same way on public pages. GA4 also records your device category, operating system and browser.

Where available, page views may include coarse network attributes — network type (for example ISP, business, hosting or mobile) and yes/no indicators for VPN, proxy, hosting and mobile-carrier use. Precise coordinates, venue names, organisation names and raw IP addresses are never sent to Google Analytics.

GA4 is not loaded on preview environments or when a visit begins on an administrative screen, and measurement is switched off while administrative screens are open, so their addresses are not sent to Google.

Which interactions Google records automatically — such as page changes, scrolls and outbound clicks — is governed by GA4’s Enhanced Measurement settings in our Google Analytics account rather than by this website’s code.

Where required by applicable law, non-essential analytics do not operate until consent has been given, as described in Section 11.

Separately from GA4, and without setting cookies on your device, our servers may enrich visits with coarse network information through IPinfo, as described in the Privacy Policy (Section 13). This enrichment sets no cookies or advertising identifiers and operates independently of the analytics consent choice.

7. Authentication Technologies

Authentication technologies are used to:

• recognise a secure signed-in session;
• process sign-in links;
• protect the Cabinet;
• prevent unauthorised account access;
• complete sign-out;
• support recovery or verification flows.

Removing authentication-related storage may sign the user out or interrupt account functionality.

8. Acquisition Bag and Assemblage Storage

The website may use browser storage or account-based records to maintain:

• objects placed in the Acquisition bag;
• objects saved to an Assemblage;
• relevant session state.

For visitors who are not signed in, certain selections may be stored locally on the device.

For signed-in collectors, selections may be associated with the account so that they can be retrieved across eligible sessions or devices.

9. Payment and Fraud-Prevention Technologies

During checkout, payment and security providers may use cookies or comparable technologies to:

• process payment securely;
• authenticate the transaction;
• prevent fraud;
• evaluate device or session risk;
• comply with financial and regulatory obligations.

These technologies may be necessary to complete the requested transaction.

Their use may also be governed by the payment provider’s own policies.

10. Embedded Content and External Platforms

Where the website includes embedded media, social links or content from another platform, the external provider may place or access technologies when the feature is used.

Simply displaying a standard outbound link should not by itself require CastaliaLux to activate unnecessary third-party tracking.

11. Cookie Consent

In the European Union, the European Economic Area, the United Kingdom and Switzerland — and wherever the visitor’s country cannot be determined — analytics storage is denied by default and a notice is shown before analytics operate. The notice offers a single choice: Accept or Decline.

Your choice is stored in a first-party cookie (castalialux_analytics_consent) for one year and is applied to analytics storage. Advertising-related purposes (ad storage, ad user data and ad personalisation) remain denied in all cases.

Outside the regions listed above, analytics operate by default without a prompt.

Consent is not implied merely because a visitor continues browsing. Declining does not prevent access to the ordinary public content of the website.

Strictly necessary and functional technologies described in Sections 4, 5, 7, 8 and 9 operate regardless of the analytics choice, where applicable law permits this.

12. Managing Cookie Preferences

The consent notice appears when analytics consent is required and no choice has been recorded. To change your choice later, you may delete the castalialux_analytics_consent cookie through your browser settings; the notice will appear again on your next visit. The Cookies link in the website footer leads to this policy, which explains the consent flow.

A visitor may also delete or block cookies through browser or device settings.

Browser-level blocking may affect:

• sign-in;
• remembered selections;
• Acquisition bag continuity;
• checkout;
• security;
• general website functionality.

13. Withdrawing Consent

Where processing is based on consent, that consent may be withdrawn at any time through the available cookie settings.

Withdrawal does not make earlier consent-based processing unlawful.

Following withdrawal, optional technologies should stop operating to the extent technically and legally required. Existing cookies may need to be deleted or allowed to expire, depending on implementation.

14. Do Not Track and Browser Signals

Some browsers transmit “Do Not Track” or similar preference signals.

Because there is no single universally implemented standard governing all such signals, the website may not respond consistently to every signal.

Where applicable law requires recognition of a specific legally valid preference mechanism, CastaliaLux will aim to honour that requirement.

15. Current Cookie Inventory

The website currently uses the following technologies:

First-party

• castalialux_analytics_consent — stores your Accept or Decline analytics choice; persistent, one year;
• sign-in session cookies — maintain a secure signed-in session; expire with the browser session or according to provider settings.

Browser storage

• local storage — retains the Acquisition bag and Assemblage selections for visitors who are not signed in;
• session storage — a single entry (“castalia:net-params”) holds the coarse network flags for the current browser session and is cleared when the browser session ends.

Third-party, when analytics consent has been granted

• Google Analytics 4 may set its own cookies (such as _ga) to distinguish visits; their lifetime is set by Google.

Third-party, during checkout

• payment and security providers may set their own technologies as described in Section 9.

The website sets no advertising cookies. Where consent is required and analytics storage is denied — or before a choice has been made — Google Analytics cookies are not stored.

The precise technologies may change as the secure infrastructure evolves; CastaliaLux periodically reviews its production environment and updates this policy where necessary.

16. Changes to This Cookie Policy

We may update this Cookie Policy when technologies, providers, website functions or legal requirements change.

The latest version will be published on this page with a revised “Last updated” date.

17. Contact

This Cookie Policy is issued by CastaliaLux LLC, FZ, a company registered and headquartered in Dubai, United Arab Emirates. CastaliaLux maintains an international presence in Hong Kong, London and the United States.

For questions regarding cookies or privacy choices, please contact CastaliaLux through the Contact page.